AWS Artifact compliance reports addresses the separate need to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.

AWS Security Lake centralized security data addresses the separate need to collect security logs in an analyzable data lake because security Lake can centralize supported security event and log data for analysis; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.

AWS Organizations SCP addresses the separate need to establish maximum account permissions across an AWS organization because service control policies limit the permissions available to principals in affected member accounts; it is not as direct as Centralized security logging for the actual requirement to retain and correlate audit records from multiple accounts.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to bind a permissions policy directly to one identity rather than sharing it, which calls for Inline IAM policy rather than IAM user or the earlier Customer managed IAM policies.

Customer managed IAM policies primarily supports the earlier need to reuse an organization-authored permissions policy across appropriate identities because customer managed policies allow centralized versioning and reuse of customized permissions, but the new task is to bind a permissions policy directly to one identity rather than sharing it; that is why Inline IAM policy is preferable here.

Cross-account role assumption is intended to allow a principal in one AWS account to gain defined temporary permissions in another because a cross-account role requires suitable trust and permission configuration; in this design the new outcome is to bind a permissions policy directly to one identity rather than sharing it, which calls for Inline IAM policy rather than Cross-account role assumption or the earlier Customer managed IAM policies.

AWS hypervisor maintenance addresses the separate need to identify who maintains the virtualization host beneath an EC2 instance because AWS manages the host operating environment and virtualization components for EC2; it is not as direct as Customer S3 bucket policy for the actual requirement to decide who restricts public or cross-account access to stored objects.

Customer logging and retention settings addresses the separate need to decide who enables appropriate activity logging and keeps records as required because customers configure service logging, centralize records and apply retention policies to their workloads; it is not as direct as Customer S3 bucket policy for the actual requirement to decide who restricts public or cross-account access to stored objects.

Customer compliance obligations addresses the separate need to determine who ensures application use and data handling meet the customer's regulations because customers remain responsible for their legal obligations, data usage and service configurations; it is not as direct as Customer S3 bucket policy for the actual requirement to decide who restricts public or cross-account access to stored objects.

Amazon Inspector is intended to assess supported workloads for exploitable software weaknesses because inspector identifies vulnerability and exposure findings for covered resources; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than Amazon Inspector or the earlier AWS Shield Standard.

AWS Shield Standard primarily supports the earlier need to provide baseline DDoS protections for supported AWS resources because shield Standard supplies automatic DDoS protection to supported resources, but the new task is to securely store supported credentials and coordinate secret rotation; that is why AWS Secrets Manager is preferable here.

AWS Config is intended to identify changes in supported AWS resource settings over time because config maintains resource configuration history and compliance evaluations; in this design the new outcome is to securely store supported credentials and coordinate secret rotation, which calls for AWS Secrets Manager rather than AWS Config or the earlier AWS Shield Standard.

AWS Artifact compliance reports is intended to obtain AWS third-party compliance reports and contractual documents because artifact provides self-service access to selected AWS compliance documentation and agreements; in this design the new outcome is to prevent one principal from controlling incompatible business functions, which calls for Separation of duties rather than AWS Artifact compliance reports or the earlier AWS Resource Access Manager sharing.

AWS Resource Access Manager sharing primarily supports the earlier need to share supported AWS resources across accounts in a controlled way because AWS RAM enables supported resource sharing with eligible accounts or organizations, but the new task is to prevent one principal from controlling incompatible business functions; that is why Separation of duties is preferable here.

AWS CloudTrail event history is intended to review who invoked AWS management API actions in an account because cloudTrail records AWS account API activity and supports investigation of management actions; in this design the new outcome is to prevent one principal from controlling incompatible business functions, which calls for Separation of duties rather than AWS CloudTrail event history or the earlier AWS Resource Access Manager sharing.

IAM permissions boundary primarily supports the earlier need to limit the maximum permissions an identity policy can grant to a user or role because a permissions boundary acts as a ceiling on effective identity-based permissions, but the new task is to give each identity only the access needed to do its assigned work; that is why Principle of least privilege is preferable here.

AWS Organizations member-account guardrails is intended to restrict maximum access by applying organizational policies because organization-level policies can constrain member accounts regardless of broader IAM allows; in this design the new outcome is to give each identity only the access needed to do its assigned work, which calls for Principle of least privilege rather than AWS Organizations member-account guardrails or the earlier IAM permissions boundary.

IAM role temporary credentials is intended to provide temporary access to a trusted principal or AWS workload because assuming an IAM role yields temporary credentials subject to role trust and permissions policies; in this design the new outcome is to give each identity only the access needed to do its assigned work, which calls for Principle of least privilege rather than IAM role temporary credentials or the earlier IAM permissions boundary.

Customer application patching on EC2 is intended to determine who updates software installed by a customer on an EC2 VM because the customer is responsible for custom code and software installed on its virtual machines; in this design the new outcome is to recognize how patch duties differ between provider hosts and customer-managed instances, which calls for Shared patch-management responsibility rather than Customer application patching on EC2 or the earlier Customer RDS access controls.

Customer RDS access controls primarily supports the earlier need to identify who sets database credentials and network exposure for an RDS workload because customers manage who can reach and authenticate to their databases and how data is used, but the new task is to recognize how patch duties differ between provider hosts and customer-managed instances; that is why Shared patch-management responsibility is preferable here.

Customer EC2 guest OS patching is intended to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening; in this design the new outcome is to recognize how patch duties differ between provider hosts and customer-managed instances, which calls for Shared patch-management responsibility rather than Customer EC2 guest OS patching or the earlier Customer RDS access controls.

AWS physical data-center security is intended to identify who protects buildings, hardware and physical facilities because AWS controls physical access, environmental safeguards and infrastructure facilities supporting its services; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than AWS physical data-center security or the earlier Customer EC2 guest OS patching.

Customer EC2 guest OS patching primarily supports the earlier need to determine who installs security updates inside a customer-managed EC2 operating system because customers maintain the guest OS, including relevant patches, configuration and hardening, but the new task is to determine who selects subnets, routes and exposure within a VPC; that is why Customer VPC network design is preferable here.

AWS S3 infrastructure availability is intended to identify who maintains the infrastructure used to operate Amazon S3 because AWS manages the underlying hardware, facilities and service platform for S3; in this design the new outcome is to determine who selects subnets, routes and exposure within a VPC, which calls for Customer VPC network design rather than AWS S3 infrastructure availability or the earlier Customer EC2 guest OS patching.

IAM user is intended to assign a directly managed AWS account identity when a specific long-lived IAM identity is appropriate because IAM users are identities defined within an AWS account with configurable permissions; in this design the new outcome is to reduce exposure of the AWS account's highly privileged root identity, which calls for Root user credential protection rather than IAM user or the earlier Credential rotation.

Credential rotation primarily supports the earlier need to reduce risk when long-lived programmatic secrets must be retained because rotating access keys and other secrets limits the lifetime of exposed credentials, but the new task is to reduce exposure of the AWS account's highly privileged root identity; that is why Root user credential protection is preferable here.

IAM Identity Center external directory is intended to integrate existing workforce identities with AWS account access because identity Center can work with supported external identity sources for centralized access; in this design the new outcome is to reduce exposure of the AWS account's highly privileged root identity, which calls for Root user credential protection rather than IAM Identity Center external directory or the earlier Credential rotation.

That description belongs to AWS Config because config maintains resource configuration history and compliance evaluations; it is used to identify changes in supported AWS resource settings over time, not to explain how Amazon Macie provides the function to identify potentially sensitive data stored in Amazon S3.

That description belongs to AWS Shield Standard because shield Standard supplies automatic DDoS protection to supported resources; it is used to provide baseline DDoS protections for supported AWS resources, not to explain how Amazon Macie provides the function to identify potentially sensitive data stored in Amazon S3.

That description belongs to AWS WAF managed rule groups because managed rule groups provide ready-to-use WAF rules for supported web endpoints; it is used to apply common web-request protection patterns using maintained rules, not to explain how Amazon Macie provides the function to identify potentially sensitive data stored in Amazon S3.

AWS Certificate Manager TLS certificates is intended to provision and manage certificates for supported TLS endpoints because aCM manages public or imported certificates for use with integrated services; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS Certificate Manager TLS certificates or the earlier Amazon GuardDuty threat detection.

Amazon GuardDuty threat detection primarily supports the earlier need to detect suspicious account or workload behavior from security signals because guardDuty analyzes supported event and telemetry sources to identify potential malicious activity, but the new task is to filter HTTP and HTTPS requests reaching supported applications; that is why AWS WAF web request filtering is preferable here.

AWS KMS managed keys is intended to control encryption keys for supported AWS integrated services because kMS supports managed cryptographic key lifecycle and access controls for integrated workloads; in this design the new outcome is to filter HTTP and HTTPS requests reaching supported applications, which calls for AWS WAF web request filtering rather than AWS KMS managed keys or the earlier Amazon GuardDuty threat detection.